Backend
Cookie flags: HttpOnly, Secure, SameSite
Three attributes decide whether your cookie is sent at all. Here's what each one does, and why yours is missing.
How it actually works
The engineering questions you get asked, and the bugs you actually hit. Drawn, one mechanism at a time, in the order the videos ship.